Precise archive is only signed with the old key. To support using the precise archive in newer releases, such as with debootstrap, we need to do the following:
1- Make sure Precise's apt supports a double-signed release file 2- Start double-signing the Precise archive 3- Double-sign old ISO *SUMS files We can then drop the old key in the dev release and in an update to stable releases. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to ubuntu-keyring in Ubuntu. https://bugs.launchpad.net/bugs/1363482 Title: ubuntu-keyring includes 1024D keys Status in Ubuntu CD Images: New Status in ubuntu-keyring package in Ubuntu: Confirmed Bug description: ubuntu-keyring as shipped in trusty contains old 1024D keys dating back to 2004 which are still being trusted for the main archive: % gpg /usr/share/keyrings/ubuntu-archive-keyring.gpg | grep 1024D pub 1024D/437D05B5 2004-09-12 Ubuntu Archive Automatic Signing Key <[email protected]> pub 1024D/FBB75451 2004-12-30 Ubuntu CD Image Automatic Signing Key <[email protected]> Given that newer 4096R keys are present and have been in precise (through -updates) and trusty, it seems to be about time to drop the older keys. (In the hope that apt does not chose on signatures it cannot verify, otherwise the publisher would need to stop signing with the old key as well.) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-cdimage/+bug/1363482/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
